﻿#pragma once
#include <vector>
using namespace std;

//进程信息
typedef struct _PROCESSINFO
{
	wchar_t szPid[15];//保存进程ID
	wchar_t countThread[15];//保存线程数量
	wchar_t  szExeFile[MAX_PATH];//进程名称
	wchar_t path[MAX_PATH * 2];//进程路径
}PROCESSINFO;

// CMyInjectionDlg 对话框

class CMyInjectionDlg : public CDialogEx
{
	DECLARE_DYNAMIC(CMyInjectionDlg)

public:
	CMyInjectionDlg(CWnd* pParent = nullptr);   // 标准构造函数
	virtual ~CMyInjectionDlg();

// 对话框数据
#ifdef AFX_DESIGN_TIME
	enum { IDD = IDD_DIALOG_RemoteThreadInjection };
#endif

protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支持
	DECLARE_MESSAGE_MAP()

private:
	// DLL路径
	CString csDllPath;

	// list控件
	CListCtrl m_ListCtrl;

	//向量容器保存进程信息
	vector<PROCESSINFO> vecProcessInfo;

	// DLL路径
	TCHAR filePath[MAX_PATH];

	//向量容器保存线程信息
	vector<DWORD> vecThreadId;

	//设置函数ZwCreateThreadEx指针
#ifdef _WIN64
	typedef DWORD(WINAPI* fnZwCreateThreadEx)(
		PHANDLE ThreadHandle,
		ACCESS_MASK DesiredAccess,
		LPVOID ObjectAttributes,
		HANDLE ProcessHandle,
		LPTHREAD_START_ROUTINE lpStartAddress,
		LPVOID lpParameter,
		ULONG CreateThreadFlags,
		SIZE_T ZeroBits,
		SIZE_T StackSize,
		SIZE_T MaximumStackSize,
		LPVOID pUnkown);
#else
	typedef DWORD(WINAPI* fnZwCreateThreadEx)(
		PHANDLE ThreadHandle,
		ACCESS_MASK DesiredAccess,
		LPVOID ObjectAttributes,
		HANDLE ProcessHandle,
		LPTHREAD_START_ROUTINE lpStartAddress,
		LPVOID lpParameter,
		BOOL CreateSuspended,
		DWORD dwStackSize,
		DWORD dw1,
		DWORD dw2,
		LPVOID pUnkown);
#endif
	fnZwCreateThreadEx ZwCreateThreadEx = NULL;
		
public:
	//重写初始化虚函数
	virtual BOOL OnInitDialog();

	//响应文件拖拽
	afx_msg void OnDropFiles(HDROP hDropInfo);

	//刷新进程信息
	void RefreshProcess();

	//响应右键消息
	afx_msg void OnNMRClickList1(NMHDR* pNMHDR, LRESULT* pResult);

	//结束进程
	void TerminateProcessID(DWORD processID);

	//打开指定路径的文件夹
	void OpenFilePathFolder(CString csDir);

	//遍历容器设置list
	void ListVector_SetList();

	//读取文件到内存
	char* ReadFileToMemory(char* pFilePath);

	//判断是否Dll文件
	BOOL IsDllFile(char* pFileBuff);

	//远程线程注入
	BOOL CreateRemoteThreadInjection(DWORD dwPID, char* pDllPath);

	//突破Session0
	BOOL Session0Injection(DWORD dwPID, char* pDllPath);

	//APC注入
	BOOL InjectByApc(DWORD dwPID, char* pDllPath);

	//获取线程信息
	BOOL GetThreadIdByProcessId(DWORD Pid, vector<DWORD>& vecThreadId);
};
